@visual-z/xeno 0.2.1 → 0.4.0

package/src/core/handoff.ts

@@ -19,6 +19,11 @@ import type { ProgressEvidence } from "./progress.ts";
 import { isExecutionOutcome, type ExecutionOutcome } from "./outcome.ts";
 import type { WorkItem } from "./work-state.ts";
 import type { EvidenceLink } from "./evidence-links.ts";
+import type { WorkingSet } from "./working-set.ts";
+import { RECOVERY_SECTIONS, RECOVERY_KINDS } from "./recovery-sources.ts";
+import type { AcceptanceState } from "./acceptance.ts";
+import type { LoadedSkill } from "./skills.ts";
+import type { ProcessObservation } from "./process-state.ts";
 import { emitYaml } from "./yaml.ts";
 
 export const HANDOFF_VERSION = 1 as const;
@@ -34,6 +39,8 @@ export type Evidence = {
   event_id: string;
   /** Exact observed workspace after the command; absence means legacy/unknown. */
   workspace_sha256?: string;
+  /** P.3: omitted on historical full-workspace observations. */
+  workspace_scope?: "source-v1";
 }
 
 export type CompletedItem = {
@@ -79,12 +86,16 @@ export type BlockedItem = {
 }
 
 export type DecisionItem = {
+  work_id?: string;
+  source?: { node: number; event_id: string };
   chose: string;
   because: string;
   rejected?: readonly string[];
 }
 
 export type PitfallItem = {
+  work_id?: string;
+  source?: { node: number; event_id: string };
   tried: string;
   failed_because: string;
 }
@@ -110,11 +121,13 @@ export type BranchRecord = {
   /** Event id in this node where the branch was spawned. */
   spawned_at: EventId;
   purpose: string;
+  background?: true;
   /** null means unresolved, which D16 requires be visible rather than quiet. */
   resolution: "merged" | "discarded" | null;
   /** Present once the branch joined; a path, never the handoff's contents. */
   handoff_ref?: string;
   summary?: string;
+  receipt_ref?: string;
   outcome?: ExecutionOutcome;
 };
 
@@ -126,6 +139,7 @@ export type VerificationItem = {
   at?: IsoTime;
   exit?: number;
   workspace_sha256?: string;
+  workspace_scope?: "source-v1";
   stale?: true;
 }
 
@@ -142,6 +156,11 @@ export type UserTurnRecord = {
 
 export type Handoff = {
   handoff_version: typeof HANDOFF_VERSION | 2;
+  working_set?: WorkingSet;
+  acceptance?: AcceptanceState;
+  loaded_skills?: readonly LoadedSkill[];
+  /** O.14: last observations only; live capabilities cannot survive a restart. */
+  processes?: readonly ProcessObservation[];
   /** V2 arrays are carried suffixes; the immutable source rebuilds every page. */
   history?: {
     source: NodeRef;
@@ -219,8 +238,8 @@ export type Handoff = {
 const ORDER: Record<string, readonly string[]> = {
   "": [
     "handoff_version", "predecessor", "history",
-    "objective", "user_turns", "user_turns_truncated",
-    "state", "decisions", "pitfalls", "file_anchors",
+    "objective", "working_set", "user_turns", "user_turns_truncated",
+    "state", "acceptance", "loaded_skills", "processes", "decisions", "pitfalls", "file_anchors",
     "verification", "branches", "open_questions", "progress_evidence", "evidence_links",
     "continuation_valid", "budget",
   ],
@@ -239,7 +258,9 @@ const ORDER: Record<string, readonly string[]> = {
   pitfalls: ["tried", "failed_because"],
   file_anchors: ["path", "sha256", "read_ranges", "touched"],
   verification: ["gate", "status", "at", "exit"],
-  branches: ["node", "spawned_at", "purpose", "resolution", "handoff_ref", "summary", "outcome"],
+  branches: ["node", "spawned_at", "purpose", "resolution", "handoff_ref", "summary", "outcome", "receipt_ref", "background"],
+  processes: ["session", "node", "event", "observed", "command", "exit", "output"],
+  "processes.output": ["sha256", "path", "bytes"],
   "branches.outcome": ["status", "reason"],
   evidence_links: ["id", "work", "what", "event", "resource", "version", "freshness", "superseded_by"],
   budget: ["nodes_on_path", "nodes_without_progress"],
@@ -279,6 +300,10 @@ export type Violation = {
     | "INVALID_EXECUTION_OUTCOME"
     | "INVALID_WORK_STATE"
     | "INVALID_EVIDENCE_LINK"
+    | "INVALID_WORKING_SET"
+    | "INVALID_ACCEPTANCE"
+    | "INVALID_SKILL_SOURCE"
+    | "INVALID_PROCESS_STATE"
     | "BAD_VERSION";
   detail: string;
 }
@@ -297,6 +322,10 @@ export function validateHandoff(h: Handoff): Violation[] {
   }
   const workIds = new Set<string>();
   for (const item of h.state.work_items ?? []) {
+    if (item.depends_on && (new Set(item.depends_on).size !== item.depends_on.length || item.depends_on.includes(item.id) ||
+      item.depends_on.some(dep => !dep.trim())) || item.owner !== undefined && (!item.owner.trim() || !item.owner_event)) {
+      v.push({ code: "INVALID_WORK_STATE", detail: `invalid dependencies or ownership for work ${item.id}` });
+    }
     const proven = item.verification === "verified" || item.verification === "stale";
     if (!item.id.trim() || workIds.has(item.id) || !item.what.trim() || !item.opened_at || !item.updated_at ||
         !["active", "blocked", "completed", "cancelled"].includes(item.status) ||
@@ -318,13 +347,29 @@ export function validateHandoff(h: Handoff): Violation[] {
   if (h.handoff_version !== HANDOFF_VERSION && h.handoff_version !== 2) {
     v.push({ code: "BAD_VERSION", detail: `expected ${HANDOFF_VERSION}, got ${h.handoff_version}` });
   }
+  if (h.working_set) {
+    const view = h.working_set;
+    if (![1, 2].includes(view.version) || view.source.node !== h.predecessor?.node || view.source.sha256 !== h.predecessor?.sha256 ||
+        !Number.isSafeInteger(view.omitted.work) || view.omitted.work < 0 || !Number.isSafeInteger(view.omitted.references) || view.omitted.references < 0 ||
+        new Set(view.work.map(item => item.id)).size !== view.work.length || view.work.some(item => !["active", "blocked"].includes(item.status)) ||
+        view.references.some(reference => !reference.event) ||
+        view.version === 2 && (!view.recovery_sections || RECOVERY_SECTIONS.some(section => {
+          const range = view.recovery_sections![section], references = view.references.filter(ref => ref.kind === RECOVERY_KINDS[section]);
+          return !range || !Number.isSafeInteger(range.total) || !Number.isSafeInteger(range.omitted) || range.omitted < 0 || range.omitted > range.total ||
+            range.total - range.omitted !== references.length || new Set(references.map(ref => ref.event)).size !== references.length ||
+            references.some(ref => !Number.isSafeInteger(ref.node) || Number(ref.node) < 0 || ref.provenance !==
+              (section === "users" ? "user_message" : section === "next_actions" ? "model_annotation" : "observation"));
+        }))) {
+      v.push({ code: "INVALID_WORKING_SET", detail: "working set must reference its source and explicit active state" });
+    }
+  }
   if (h.handoff_version === 2) {
     const history = h.history;
     if (!history || !h.predecessor || history.source.node !== h.predecessor.node ||
         history.source.sha256 !== h.predecessor.sha256) {
       v.push({ code: "INVALID_HISTORY", detail: "paged handoff must identify its immutable predecessor" });
     } else for (const [section, range] of Object.entries(history.sections)) {
-      const values = section.startsWith("state.") ? h.state[section.slice(6) as keyof Handoff["state"]]
+      const values = section === "acceptance.criteria" ? h.acceptance?.criteria : section === "acceptance.targets" ? h.acceptance?.targets : section.startsWith("state.") ? h.state[section.slice(6) as keyof Handoff["state"]]
         : h[section as keyof Handoff];
       if (!Array.isArray(values) || !Number.isSafeInteger(range.total) || !Number.isSafeInteger(range.offset) ||
           range.offset < 0 || range.total < range.offset || range.total - range.offset !== values.length) {
@@ -333,6 +378,22 @@ export function validateHandoff(h: Handoff): Violation[] {
     }
   }
 
+  if (h.acceptance?.criteria.some(item => item.status === "pass" && (!item.evidence || item.evidence.exit !== 0) ||
+      item.status === "accepted" && (item.kind !== "human" || !item.accepted_event || item.target && !item.accepted_binding))) {
+    v.push({ code: "INVALID_ACCEPTANCE", detail: "criteria need actual command or user decision evidence" });
+  }
+  if (h.acceptance?.targets?.some(target => target.status === "ready" && (!target.observation || !target.binding || !target.session || !target.pid || !target.entry || !target.build_event))) {
+    v.push({ code: "INVALID_ACCEPTANCE", detail: "ready targets need original build and owned instance observations" });
+  }
+  if (h.loaded_skills?.some(item => !/^[a-f0-9]{64}$/.test(item.sha256) || item.sha256 !== item.artifact ||
+      !item.path || !item.event || !Number.isSafeInteger(item.node) || item.node < 0)) {
+    v.push({ code: "INVALID_SKILL_SOURCE", detail: "loaded skill must reference original instruction bytes and event" });
+  }
+  if (h.processes?.some(item => !Number.isSafeInteger(item.session) || item.session < 1 || !Number.isSafeInteger(item.node) || item.node < 0 ||
+    !item.event || !["running", "exited"].includes(item.observed) || item.observed === "exited" && !Number.isInteger(item.exit) ||
+    item.output && (!/^[a-f0-9]{64}$/.test(item.output.sha256) || !Number.isSafeInteger(item.output.bytes) || item.output.bytes < 0 || !item.output.path))) {
+    v.push({ code: "INVALID_PROCESS_STATE", detail: "process state requires original observation and actual exit evidence" });
+  }
   for (const c of h.state.completed) {
     if (c.evidence.exit !== 0) {
       v.push({

package/src/core/harness-diagnostics.ts

@@ -0,0 +1,206 @@
+/** D11 / O.3: classify durable execution facts, never error words in tool output. */
+import type { LogEvent, ToolResultEvent } from "./events.ts";
+import type { BenchmarkUsage } from "./benchmark.ts";
+import { canonicalValue } from "./continuation.ts";
+
+export type ResultClass = "success" | "invalid_input" | "cancelled" | "timeout" | "command_nonzero" |
+  "execution_failed" | "rejected" | "unclassified_failure";
+
+export function classifyToolResult(event: ToolResultEvent): ResultClass {
+  const code = event.diagnostic?.code;
+  if (code === "invalid_input") return "invalid_input";
+  if (code === "cancelled" || event.outcome?.reason === "cancelled") return "cancelled";
+  if (code === "timeout" || event.outcome?.reason === "timeout") return "timeout";
+  if (event.effect?.kind === "command" && event.effect.exit !== 0) return "command_nonzero";
+  if (event.ok) return "success";
+  if (event.diagnostic?.execution === "not_started" ||
+    ["version_mismatch", "not_found", "ambiguous_edit", "permission_denied", "environment_missing"].includes(code ?? "")) return "rejected";
+  if (code === "execution_failed" || code === "unknown_effect" || event.outcome?.reason === "execution_error") return "execution_failed";
+  return "unclassified_failure";
+}
+
+export interface DiagnosticRequest {
+  request: number;
+  node: number | null;
+  usage: BenchmarkUsage | null;
+  responseModel: string | null;
+  failure: string | null;
+  firstDeltaMs: number | null;
+  wallMs: number | null;
+  prefixUnchanged: boolean | null;
+  sharedInputBytes: number | null;
+  frozenSha256: string | null;
+  /** Raw terminal counts can remain known when a cache breakdown is absent. */
+  reportedPromptTokens?: number | null;
+  reportedOutputTokens?: number | null;
+}
+export interface ToolCounters {
+  calls: number; providerCalls: number; invocations: number; nestedInvocations: number;
+  results: number; pairedCalls: number; orphanCalls: number; orphanResults: number;
+  duplicateProviderCalls: number; duplicateInvocations: number; duplicateResults: number;
+  repeatedProviderInputs: number; repeatedInvocationInputs: number;
+  classes: Record<ResultClass, number>;
+  diagnosticCodes: Record<string, number>;
+  commandExits: Record<string, number>;
+  expectedNonzeroCommands: number;
+  undeclaredNonzeroCommands: number;
+}
+const classes = (): Record<ResultClass, number> => ({ success: 0, invalid_input: 0, cancelled: 0, timeout: 0,
+  command_nonzero: 0, execution_failed: 0, rejected: 0, unclassified_failure: 0 });
+const counters = (): ToolCounters => ({ calls: 0, providerCalls: 0, invocations: 0, nestedInvocations: 0,
+  results: 0, pairedCalls: 0, orphanCalls: 0, orphanResults: 0, duplicateProviderCalls: 0,
+  duplicateInvocations: 0, duplicateResults: 0, repeatedProviderInputs: 0, repeatedInvocationInputs: 0,
+  classes: classes(), diagnosticCodes: {}, commandExits: {}, expectedNonzeroCommands: 0, undeclaredNonzeroCommands: 0 });
+function add(record: Record<string, number>, key: string): void { record[key] = (record[key] ?? 0) + 1; }
+const validCount = (value: number): boolean => Number.isSafeInteger(value) && value >= 0;
+const reportedCount = (value: number | null | undefined): number | null => typeof value === "number" && validCount(value) ? value : null;
+const validTime = (value: number | null): number | null => value !== null && Number.isFinite(value) && value >= 0 ? value : null;
+function observedUsage(usage: BenchmarkUsage | null): BenchmarkUsage | null {
+  return usage && [usage.input_tokens, usage.output_tokens, usage.cache_read_input_tokens,
+    usage.cache_creation_input_tokens].every(validCount) ? usage : null;
+}
+function quantile(values: readonly number[], q: number): number | null {
+  return values.length ? values.toSorted((a, b) => a - b)[Math.max(0, Math.ceil(values.length * q) - 1)]! : null;
+}
+interface Call {
+  name: string; provider: boolean; invocation: boolean; nested: boolean;
+  providerInput: string | null; invocationInput: string | null;
+}
+
+/**
+ * Inputs and outputs remain private. Equal-input counts use canonical original
+ * model arguments and immutable admitted-input hashes separately (O.3 / Pi A).
+ * Expected nonzero exits need an evaluator declaration; an exit alone cannot
+ * prove a command was accidental, and model prose cannot establish intent.
+ */
+export function summarizeHarnessDiagnostics(input: {
+  events: readonly LogEvent[]; requests: readonly DiagnosticRequest[];
+  expectedNonzeroCallIds?: readonly string[];
+}) {
+  const tools: Record<string, ToolCounters> = {};
+  const tool = (name: string): ToolCounters => tools[name] ??= counters();
+  const calls = new Map<string, Call>(), results = new Map<string, ToolResultEvent[]>(), seenEvents = new Set<string>();
+  const guidance: Record<string, number> = {}, cuts: Record<string, number> = {}, cleanupProcessExits: Record<string, number> = {};
+  let duplicateEvents = 0, interruptions = 0;
+  for (const event of input.events) {
+    if (seenEvents.has(event.id)) { duplicateEvents++; continue; }
+    seenEvents.add(event.id);
+    if (event.t === "guidance") add(guidance, event.reason);
+    if (event.t === "cut") add(cuts, event.reason);
+    if (event.t === "interrupt") interruptions++;
+    if (event.t === "process_exit") add(cleanupProcessExits, String(event.exit));
+    if (event.t === "assistant") for (const block of event.blocks) {
+      if (block.type !== "tool_use") continue;
+      const existing = calls.get(block.call_id), stats = tool(block.name);
+      if (existing?.provider) stats.duplicateProviderCalls++;
+      calls.set(block.call_id, { name: existing?.name ?? block.name, provider: true,
+        invocation: existing?.invocation ?? false, nested: existing?.nested ?? false,
+        providerInput: canonicalValue(block.input), invocationInput: existing?.invocationInput ?? null });
+    }
+    if (event.t === "tool_invocation") {
+      const existing = calls.get(event.call_id), stats = tool(event.name);
+      if (existing?.invocation) stats.duplicateInvocations++;
+      calls.set(event.call_id, { name: existing?.name ?? event.name, provider: existing?.provider ?? false,
+        invocation: true, nested: event.parent_call_id !== undefined,
+        providerInput: existing?.providerInput ?? null, invocationInput: event.input_ref.sha256 });
+    }
+    if (event.t === "tool_result") {
+      const found = results.get(event.call_id) ?? [];
+      found.push(event); results.set(event.call_id, found);
+    }
+  }
+  const providerInputs = new Map<string, Set<string>>(), invocationInputs = new Map<string, Set<string>>();
+  const repeat = (groups: Map<string, Set<string>>, name: string, key: string | null): boolean => {
+    if (key === null) return false;
+    const seen = groups.get(name) ?? new Set<string>(), repeated = seen.has(key);
+    seen.add(key); groups.set(name, seen); return repeated;
+  };
+  for (const [id, call] of calls) {
+    const stats = tool(call.name); stats.calls++;
+    if (call.provider) stats.providerCalls++;
+    if (call.invocation) stats.invocations++;
+    if (call.nested) stats.nestedInvocations++;
+    if (repeat(providerInputs, call.name, call.providerInput)) stats.repeatedProviderInputs++;
+    if (repeat(invocationInputs, call.name, call.invocationInput)) stats.repeatedInvocationInputs++;
+    if (results.has(id)) stats.pairedCalls++; else stats.orphanCalls++;
+  }
+  const expected = new Set(input.expectedNonzeroCallIds ?? []);
+  for (const [id, found] of results) {
+    const call = calls.get(id), stats = tool(call?.name ?? "<orphan>");
+    stats.duplicateResults += Math.max(0, found.length - 1);
+    for (const event of found) {
+      stats.results++;
+      if (!call) stats.orphanResults++;
+      stats.classes[classifyToolResult(event)]++;
+      if (event.diagnostic) add(stats.diagnosticCodes, event.diagnostic.code);
+      if (event.effect?.kind === "command") {
+        add(stats.commandExits, String(event.effect.exit));
+        if (event.effect.exit !== 0) {
+          if (expected.has(id)) stats.expectedNonzeroCommands++; else stats.undeclaredNonzeroCommands++;
+        }
+      }
+    }
+  }
+  const requestIds = new Set<number>(), requests: {
+    request: number; node: number | null; usageKnown: boolean; promptTokens: number | null;
+    cachedTokens: number | null; cacheWriteTokens: number | null; outputTokens: number | null;
+    cacheHitRate: number | null; responseModel: string | null; failure: string | null;
+    firstDeltaMs: number | null; wallMs: number | null; prefixUnchanged: boolean | null; sharedInputBytes: number | null;
+  }[] = [];
+  const models: Record<string, number> = {};
+  const usage = { knownRequests: 0, unknownRequests: 0, requestsWithCacheReads: 0, promptTokens: 0, cachedTokens: 0,
+    cacheWriteTokens: 0, outputTokens: 0, promptKnownRequests: 0, promptUnknownRequests: 0,
+    cacheCoveredPromptTokens: 0, cacheCoverageRate: null as number | null,
+    observedCacheHitRate: null as number | null, cacheHitRate: null as number | null };
+  const prefix = { sameNodeComparisons: 0, sameNodeMutations: 0, boundaryComparisons: 0, boundaryMutations: 0,
+    unknownComparisons: 0, sameNodeFrozenMutations: 0, boundaryFrozenMutations: 0 };
+  let previous: DiagnosticRequest | undefined, duplicateRequests = 0;
+  for (const request of input.requests.toSorted((a, b) => a.request - b.request)) {
+    if (requestIds.has(request.request)) { duplicateRequests++; continue; }
+    requestIds.add(request.request);
+    const observed = observedUsage(request.usage);
+    const prompt = reportedCount(request.reportedPromptTokens) ?? (observed ?
+      observed.input_tokens + observed.cache_read_input_tokens + observed.cache_creation_input_tokens : null);
+    const output = reportedCount(request.reportedOutputTokens) ?? observed?.output_tokens ?? null;
+    if (prompt !== null) { usage.promptKnownRequests++; usage.promptTokens += prompt; } else usage.promptUnknownRequests++;
+    if (output !== null) usage.outputTokens += output;
+    if (observed) {
+      usage.knownRequests++; usage.cacheCoveredPromptTokens += prompt!; usage.cachedTokens += observed.cache_read_input_tokens;
+      usage.cacheWriteTokens += observed.cache_creation_input_tokens;
+      if (observed.cache_read_input_tokens > 0) usage.requestsWithCacheReads++;
+    } else usage.unknownRequests++;
+    if (request.responseModel !== null) add(models, request.responseModel);
+    if (previous) {
+      if (previous.node === null || request.node === null || request.prefixUnchanged === null) prefix.unknownComparisons++;
+      else if (previous.node === request.node) { prefix.sameNodeComparisons++; if (!request.prefixUnchanged) prefix.sameNodeMutations++; }
+      else { prefix.boundaryComparisons++; if (!request.prefixUnchanged) prefix.boundaryMutations++; }
+      if (previous.frozenSha256 !== null && request.frozenSha256 !== null && previous.frozenSha256 !== request.frozenSha256) {
+        if (previous.node === request.node && request.node !== null) prefix.sameNodeFrozenMutations++;
+        else if (previous.node !== null && request.node !== null) prefix.boundaryFrozenMutations++;
+      }
+    }
+    previous = request;
+    requests.push({ request: request.request, node: request.node, usageKnown: observed !== null, promptTokens: prompt,
+      cachedTokens: observed?.cache_read_input_tokens ?? null, cacheWriteTokens: observed?.cache_creation_input_tokens ?? null,
+      outputTokens: output, cacheHitRate: observed && prompt ? observed.cache_read_input_tokens / prompt : null,
+      responseModel: request.responseModel, failure: request.failure, firstDeltaMs: validTime(request.firstDeltaMs),
+      wallMs: validTime(request.wallMs), prefixUnchanged: request.prefixUnchanged, sharedInputBytes: request.sharedInputBytes });
+  }
+  usage.observedCacheHitRate = usage.cacheCoveredPromptTokens > 0 ? usage.cachedTokens / usage.cacheCoveredPromptTokens : null;
+  usage.cacheCoverageRate = usage.promptUnknownRequests === 0 && usage.promptTokens > 0 ? usage.cacheCoveredPromptTokens / usage.promptTokens : null;
+  usage.cacheHitRate = usage.unknownRequests === 0 && usage.promptTokens > 0 ? usage.cachedTokens / usage.promptTokens : null;
+  const delta = requests.flatMap(r => r.firstDeltaMs === null ? [] : [r.firstDeltaMs]);
+  const totals = counters();
+  for (const stats of Object.values(tools)) {
+    for (const key of Object.keys(totals) as (keyof ToolCounters)[]) {
+      const value = stats[key];
+      if (typeof value === "number") (totals[key] as number) += value;
+    }
+    for (const key of Object.keys(stats.classes) as ResultClass[]) totals.classes[key] += stats.classes[key];
+    for (const key of Object.keys(stats.commandExits)) totals.commandExits[key] = (totals.commandExits[key] ?? 0) + stats.commandExits[key]!;
+    for (const key of Object.keys(stats.diagnosticCodes)) totals.diagnosticCodes[key] = (totals.diagnosticCodes[key] ?? 0) + stats.diagnosticCodes[key]!;
+  }
+  return { eventCount: seenEvents.size, duplicateEvents, tools, totals, guidance, cuts, interruptions, cleanupProcessExits,
+    requestCount: requests.length, duplicateRequests, models, usage, prefix, requests,
+    firstDeltaMs: { samples: delta.length, missing: requests.length - delta.length, p50: quantile(delta, 0.5), p95: quantile(delta, 0.95) } };
+}

package/src/core/history-query.ts

@@ -2,8 +2,9 @@
 import type { LogEvent, ToolResultEvent } from "./events.ts";
 import { canonicalValue } from "./continuation.ts";
 import { deriveEvidenceLinks, observationResources, resourceKey, type EvidenceLink } from "./evidence-links.ts";
+import type { EnvironmentValidity } from "./environment.ts";
 
-export interface HistoryEntry extends Pick<ToolResultEvent, "effect" | "outcome" | "data" | "diagnostic"> {
+export interface HistoryEntry extends Pick<ToolResultEvent, "effect" | "outcome" | "data" | "data_ref" | "diagnostic" | "observation" | "warnings"> {
   node: number;
   event: string;
   kind: string;
@@ -16,27 +17,62 @@ export interface HistoryEntry extends Pick<ToolResultEvent, "effect" | "outcome"
   work_ids?: readonly string[];
   evidence?: readonly EvidenceLink[];
   source_available?: boolean;
+  /** Runtime consumption view only; never changes the original capability receipt. */
+  environment?: EnvironmentValidity;
+  invocation?: { event: string; input: string; schema: string | null; parent_call_id?: string; origin?: "extension" };
+}
+
+/** O.15: bump when historyEntries or freshness semantics change. */
+export const HISTORY_INDEX_VERSION = 6;
+export function historyKeyInput(nodes: readonly { node: number; events: readonly LogEvent[] }[], version = HISTORY_INDEX_VERSION): string {
+  const calls = new Map<string, string>();
+  const self = (name: string | undefined) => name === "history" || name === "note";
+  return canonicalValue({ version, nodes: nodes.map(part => ({ node: part.node, events: part.events.flatMap<LogEvent>(event => {
+    // The index deliberately excludes its own reads. Effects still affect
+    // freshness, and annotations have their own durable events (O.6).
+    if (event.t === "tool_invocation") { calls.set(event.call_id, event.name); return self(event.name) ? [] : [event]; }
+    if (event.t === "tool_result" && self(calls.get(event.call_id)) && event.effect === undefined) return [];
+    if (event.t !== "assistant") return [event];
+    for (const block of event.blocks) if (block.type === "tool_use") calls.set(block.call_id, block.name);
+    const blocks = event.blocks.filter(block => block.type === "text" || block.type === "tool_use" && !self(block.name));
+    return blocks.length ? [{ ...event, blocks }] : [];
+  }) })) });
 }
 
 export function historyEntries(nodes: readonly { node: number; events: readonly LogEvent[] }[]): HistoryEntry[] {
   const entries: HistoryEntry[] = [];
   const calls = new Map<string, { name: string; input: unknown }>();
+  const invocations = new Map<string, NonNullable<HistoryEntry["invocation"]>>();
   for (const { node, events } of nodes) for (const e of events) {
     if (e.t === "assistant") {
       for (const block of e.blocks) if (block.type === "tool_use") calls.set(block.call_id, { name: block.name, input: block.input });
       const text = e.blocks.filter((b) => b.type === "text").map((b) => b.text).join("\n");
       if (text) entries.push({ node, event: e.id, kind: e.t, text });
+    } else if (e.t === "tool_invocation") {
+      calls.set(e.call_id, { name: e.name, input: e.input ?? calls.get(e.call_id)?.input ?? { artifact: e.input_ref.sha256 } });
+      invocations.set(e.call_id, { event: e.id, input: e.input_ref.sha256, schema: e.schema_ref?.sha256 ?? null,
+        ...(e.origin ? { origin: e.origin } : {}),
+        ...(e.parent_call_id ? { parent_call_id: e.parent_call_id } : {}) });
     } else if (e.t === "tool_result") {
       const call = calls.get(e.call_id);
       // Indexing query results recursively would make the index amplify itself.
       if (call?.name === "history" || call?.name === "note") continue;
       entries.push({ node, event: e.id, kind: e.t, text: e.content, ok: e.ok,
         ...(call ? { tool: call.name, input: call.input } : {}),
+        ...(invocations.has(e.call_id) ? { invocation: invocations.get(e.call_id)! } : {}),
         resources: observationResources(e, call?.input),
         ...(e.effect ? { effect: e.effect } : {}), ...(e.outcome ? { outcome: e.outcome } : {}),
         ...(e.data !== undefined ? { data: e.data } : {}), ...(e.diagnostic ? { diagnostic: e.diagnostic } : {}),
+        ...(e.data_ref ? { data_ref: e.data_ref } : {}),
+        ...(e.observation ? { observation: e.observation } : {}),
+        ...(e.warnings ? { warnings: e.warnings } : {}),
         ...(e.content_ref ? { artifact: e.content_ref.sha256 } : {}) });
-    } else if (["user", "next_action", "decision", "pitfall", "blocked", "question", "claim", "work_status", "evidence_link"].includes(e.t)) {
+    } else if (e.t === "target_observation") {
+      entries.push({ node, event: e.id, kind: e.t, text: canonicalValue(e.observation),
+        ...(e.observation.manifest ? { artifact: e.observation.manifest.sha256 } : {}) });
+    } else if (e.t === "process_exit") {
+      entries.push({ node, event: e.id, kind: e.t, text: canonicalValue(e), artifact: e.output.sha256 });
+    } else if (["work_owner", "work_dependencies", "skill_loaded", "acceptance_contract", "acceptance_decision", "user", "next_action", "decision", "pitfall", "blocked", "question", "claim", "work_status", "evidence_link"].includes(e.t)) {
       entries.push({ node, event: e.id, kind: e.t, text: e.t === "user" ? e.text : canonicalValue(e),
         ...("work_id" in e && e.work_id ? { work_ids: [e.work_id] } : {}),
         ...(e.t === "evidence_link" ? { work_ids: [e.work], ...(e.resource ? { resources: [resourceKey(e.resource)] } : {}) } : {}) });

package/src/core/history.ts

@@ -1,6 +1,8 @@
 /** D20: bounded carried state, with deterministic pages rebuilt from the log. */
 import { emitHandoff, type Handoff } from "./handoff.ts";
 import { estimateTokens } from "./tokens.ts";
+import { workingSet, recoveryWorkingSet } from "./working-set.ts";
+import type { RecoveryNodes } from "./recovery-sources.ts";
 
 // A carried handoff must leave room for another segment's work. This budget is
 // the existing 5k work floor, not a new segment threshold or an accuracy claim.
@@ -11,6 +13,10 @@ export const HISTORY_SECTIONS = [
   "branches", "open_questions", "progress_evidence",
   "state.work_items",
   "evidence_links",
+  "acceptance.criteria",
+  "acceptance.targets",
+  "loaded_skills",
+  "processes",
 ] as const;
 export type HistorySection = (typeof HISTORY_SECTIONS)[number];
 
@@ -22,6 +28,10 @@ export function historyItems(h: Handoff, section: HistorySection): readonly unkn
     case "state.blocked": return h.state.blocked;
     case "state.work_items": return h.state.work_items ?? [];
     case "evidence_links": return h.evidence_links ?? [];
+    case "acceptance.criteria": return h.acceptance?.criteria ?? [];
+    case "acceptance.targets": return h.acceptance?.targets ?? [];
+    case "loaded_skills": return h.loaded_skills ?? [];
+    case "processes": return h.processes ?? [];
     case "progress_evidence": return h.progress_evidence ?? [];
     default: return h[section];
   }
@@ -47,6 +57,10 @@ function suffixes(h: Handoff, offsets: Record<HistorySection, number>): Handoff
     open_questions: h.open_questions.slice(offsets.open_questions),
     progress_evidence: (h.progress_evidence ?? []).slice(offsets.progress_evidence),
     ...(h.evidence_links !== undefined ? { evidence_links: h.evidence_links.slice(offsets.evidence_links ?? 0) } : {}),
+    ...(h.acceptance ? { acceptance: { ...h.acceptance, criteria: h.acceptance.criteria.slice(offsets["acceptance.criteria"] ?? 0),
+      ...(h.acceptance.targets ? { targets: h.acceptance.targets.slice(offsets["acceptance.targets"] ?? 0) } : {}) } } : {}),
+    ...(h.loaded_skills ? { loaded_skills: h.loaded_skills.slice(offsets.loaded_skills ?? 0) } : {}),
+    ...(h.processes ? { processes: h.processes.slice(offsets.processes ?? 0) } : {}),
   };
 }
 
@@ -57,7 +71,11 @@ export function boundHandoff(full: Handoff, budget = DEFAULT_HANDOFF_TOKENS): Ha
   if (full.predecessor === null) throw new Error("history requires an immutable source");
   // An absent new section must not change legacy projections or frozen replay.
   const sections = HISTORY_SECTIONS.filter(section => (section !== "state.work_items" || full.state.work_items !== undefined) &&
-    (section !== "evidence_links" || full.evidence_links !== undefined));
+    (section !== "evidence_links" || full.evidence_links !== undefined) &&
+    (section !== "acceptance.criteria" || full.acceptance !== undefined) &&
+    (section !== "acceptance.targets" || full.acceptance?.targets !== undefined) &&
+    (section !== "loaded_skills" || full.loaded_skills !== undefined) &&
+    (section !== "processes" || full.processes !== undefined));
   const offsets = Object.fromEntries(sections.map((s) => [s, historyItems(full, s).length])) as Record<HistorySection, number>;
   const build = (): Handoff => ({
     ...suffixes(full, offsets),
@@ -98,3 +116,22 @@ export function historyPage(full: Handoff, section: HistorySection, offset: numb
   const end = Math.min(items.length, offset + limit);
   return { total: items.length, offset, next: end < items.length ? end : null, items: items.slice(offset, end) };
 }
+
+/** O.10: the optional priority view shares the original total budget. */
+export function boundWorkingHandoff(full: Handoff, budget = DEFAULT_HANDOFF_TOKENS): Handoff {
+  const legacy = boundHandoff(full, budget);
+  // 40% is a declared allocation hypothesis, not a measured context threshold.
+  const view = workingSet(full, budget * .4);
+  if (!view) return legacy;
+  try { return boundHandoff({ ...full, working_set: view }, budget); }
+  catch (error) { if (error instanceof RangeError) return legacy; throw error; }
+}
+
+/** R9 uses the same budget; originals are supplied by the ancestry owner. */
+export function boundRecoveryHandoff(full: Handoff, nodes: RecoveryNodes, budget = DEFAULT_HANDOFF_TOKENS, tools?: readonly string[]): Handoff {
+  const legacy = boundHandoff(full, budget);
+  const view = recoveryWorkingSet(full, nodes, budget * .4, tools);
+  if (!view) return legacy;
+  try { return boundHandoff({ ...full, working_set: view }, budget); }
+  catch (error) { if (error instanceof RangeError) return legacy; throw error; }
+}

package/src/core/integration-health.ts

@@ -0,0 +1,34 @@
+/** Q.13: observed connectivity is a cache, never authorization or replay evidence. */
+export type IntegrationFailureCode = "offline" | "rate_limited" | "auth_required" | "protocol_error" | "timeout" | "unknown";
+export type IntegrationTime = { at: number; tick: number };
+export type IntegrationHealth = {
+  state: "not_checked" | "ready" | "backoff" | "auth_required" | "protocol_error";
+  observed: IntegrationTime | null;
+  failures: number;
+  retryAt: number | null;
+  error: IntegrationFailureCode | null;
+};
+// Assumed bounds, not measured optima: avoid tight failure loops and unbounded server delays.
+export const INTEGRATION_BACKOFF_MS = 1_000;
+export const MAX_INTEGRATION_BACKOFF_MS = 60_000;
+export const INTEGRATION_HEALTH_TTL_MS = 30_000;
+
+export function initialIntegrationHealth(): IntegrationHealth {
+  return { state: "not_checked", observed: null, failures: 0, retryAt: null, error: null };
+}
+export function readyIntegrationHealth(now: IntegrationTime): IntegrationHealth {
+  return { ...initialIntegrationHealth(), state: "ready", observed: { ...now } };
+}
+export function failedIntegrationHealth(previous: IntegrationHealth, error: IntegrationFailureCode, now: IntegrationTime, retryAfterMs?: number): IntegrationHealth {
+  const failures = Math.min(16, previous.failures + 1);
+  const delay = Math.min(MAX_INTEGRATION_BACKOFF_MS, Math.max(INTEGRATION_BACKOFF_MS * 2 ** (failures - 1),
+    Number.isFinite(retryAfterMs) ? Math.max(0, retryAfterMs!) : 0));
+  const state = error === "auth_required" || error === "protocol_error" ? error : "backoff";
+  return { state, observed: { ...now }, failures, retryAt: state === "backoff" ? now.tick + delay : null, error };
+}
+export function integrationHealthView(health: IntegrationHealth, now: IntegrationTime) {
+  const age = health.observed === null ? null : Math.max(0, now.tick - health.observed.tick);
+  return { state: health.state, observed_at: health.observed?.at ?? null, age_ms: age,
+    stale: age === null || age >= INTEGRATION_HEALTH_TTL_MS, error: health.error,
+    failures: health.failures, retry_after_ms: health.retryAt === null ? null : Math.max(0, health.retryAt - now.tick) };
+}

package/src/core/keymap.ts

@@ -3,8 +3,8 @@
  * parses, reports conflicts by name, and lets the last definition win.
  *
  * Silent drop of one side of a conflict is how a shortcut "just stops
- * working" with no trail (feat-theming design). Namespaced ids follow
- * pi's scheme; the action list is ours.
+ * working" with no trail (feat-theming design). The action list is
+ * xeno's (core/action-defaults.ts, D20).
  */
 
 import { ACTION_DEFAULTS, ACTION_ALIASES } from "./action-defaults.ts";
@@ -88,26 +88,14 @@ export function resolveAction(map: Keymap, spec: string): ActionId | undefined {
 }
 
 export function defaultKeymap(platform: "posix" | "win32" | "wsl" = "posix"): Keymap {
-  // Pi's Windows shortcuts avoid terminal-reserved chords; WSL still supports job control.
-  return parseKeymap({ ...ACTION_DEFAULTS, ...(platform === "posix" ? {} : {
-    "app.suspend": platform === "win32" ? [] : ["ctrl+z"],
-    "editor.undo": platform === "win32" ? ["ctrl+z"] : ["alt+z"],
-    "app.cycleModelReverse": ["alt+p"], "app.message.followUp": ["ctrl+q"],
-    "app.message.dequeue": ["alt+q"], "app.clipboard.pasteImage": ["alt+v"],
-    "tui.altScreen.previousPrompt": ["ctrl+up"], "tui.altScreen.nextPrompt": ["ctrl+down"],
-    "tui.altScreen.search": ["ctrl+f"],
-  }) });
+  // Windows has no job control; Ctrl+Z stays a plain key there.
+  return parseKeymap({ ...ACTION_DEFAULTS, ...(platform === "win32" ? { "app.suspend": [] } : {}) });
 }
 
-/** Modal scopes deliberately share chords. Only collisions within one owner replace a binding. */
+/** Scopes share chords on purpose: arrows mean history in the composer and movement in a list. */
 export function actionScope(action: string): string {
-  if (action === "app.exit") return "exit";
-  if (action === "tui.input.copy") return "copy";
-  if (action.startsWith("tui.select.")) return "select";
-  if (action.startsWith("tui.altScreen.")) return "viewport";
-  if (action.startsWith("app.tree.")) return "tree";
-  if (action.startsWith("app.models.")) return "models";
-  if (action.startsWith("app.session.") && !["app.session.new", "app.session.tree", "app.session.fork", "app.session.resume"].includes(action)) return "session";
+  if (action.startsWith("editor.")) return "editor";
+  if (action.startsWith("list.")) return "list";
   return "global";
 }
 export function parseKeymap(json: unknown, base?: Keymap): Keymap {
@@ -135,7 +123,7 @@ export function parseKeymap(json: unknown, base?: Keymap): Keymap {
     }
   }
   const byKey: Record<string,ActionId> = {};
-  for (const [action,keys] of Object.entries(byAction)) if (["global", "exit"].includes(actionScope(action))) for (const key of keys) byKey[key] = action as ActionId;
+  for (const [action,keys] of Object.entries(byAction)) if (actionScope(action) === "global") for (const key of keys) byKey[key] = action as ActionId;
   return { byKey, byAction, diagnostics };
 }